AntiFox AI Pentesting Platform Used to Steal AWS Credentials and Access Cloud Environments

Cybersecurity researchers have uncovered a campaign in which attackers abused AntiFox, an emerging AI-powered autonomous penetration testing platform, to steal Amazon Web Services (AWS) credentials and move laterally across compromised environments.

According to Arctic Wolf Labs, Alibaba Cloud systems hosting AntiFox interfaces were linked to multiple intrusions involving malicious activity against internet-facing web applications and their associated AWS environments.

The observed attacks combined web application exploitation, web shell deployment, credential discovery, cloud service enumeration, and access to sensitive secrets and storage resources.

How Attackers Used AntiFox in the Intrusions

AntiFox is an open-source, AI-driven penetration testing platform built on the ARTEX framework. It uses a multi-agent architecture consisting of planner, worker, and main agents to automate different stages of a penetration testing engagement, including reconnaissance, attack surface discovery, exploitation, evidence collection, and report generation.

Although designed for authorized security assessments, researchers observed the platform being associated with real-world malicious activity.

In some incidents, attackers reportedly gained initial access through compromised internet-facing Microsoft Internet Information Services (IIS) applications. They then deployed an ASPX web shell using w3wp.exe, the IIS worker process, to execute operating system commands.

The attackers used the compromised IIS environment to:

  • Search for web.config files and configuration backups.
  • Extract application settings and database connection strings.
  • Enumerate debugging and error-log directories.
  • Attempt connections to internal production databases using discovered credentials.
  • Copy configuration files and logs into web-accessible upload directories.
  • Check system identity, directory permissions, and write access to the web root.

Arctic Wolf noted that the creation of an ASPX web shell by the IIS worker process, followed by command execution through the same process, indicated a likely compromise of the affected web application.

However, researchers have not identified the exact vulnerability exploited to obtain initial code execution on the IIS server.

AWS Credential Abuse and Cloud Service Enumeration

In other observed incidents, attackers reportedly began with valid AWS credentials obtained through an unknown method.

They abused legitimate AWS IAM identities to validate credentials and enumerate dozens of cloud services, including:

  • Identity and Access Management (IAM)
  • Elastic Compute Cloud (EC2)
  • Simple Storage Service (S3)
  • AWS Lambda
  • Secrets Manager
  • Key Management Service (KMS)
  • Relational Database Service (RDS)
  • Elastic Container Service (ECS)
  • Elastic Kubernetes Service (EKS)
  • Amazon Redshift and Athena
  • AWS Glue and Systems Manager
  • API Gateway and CloudWatch
  • CloudFormation and DynamoDB
  • Amazon Bedrock

Although many authenticated API requests returned AccessDenied errors, some discovery and secret-access operations were successful.

In at least some cases, attackers progressed beyond Secrets Manager enumeration and successfully executed the GetSecretValue API operation against a production secret.

Researchers also observed AWS identities being used for S3 discovery and object operations.

These activities demonstrate how stolen or exposed cloud credentials can provide attackers with opportunities to explore connected services and access sensitive production resources.

Growing Abuse of AI-Powered Penetration Testing Tools

The AntiFox activity highlights a broader trend in which threat actors are increasingly using agentic AI tools to automate offensive security operations.

Frameworks such as ARTEX and AntiFox can connect large language models with security tools, allowing agents to execute commands, analyze results, and determine subsequent actions with limited human intervention.

This approach can reduce the technical expertise required to conduct complex attacks while increasing their speed, scale, and consistency.

Researchers have also reported other campaigns involving AI agents.

One example is Operation Ghost-Campus, a campaign disclosed by VECERT. It reportedly used AI agents to create accounts on the FOFA search platform, scan internet-facing systems for misconfigurations, extract exposed OpenAI and DeepSeek API keys, and validate their available balances.

The stolen computing resources were then allegedly used to support automated academic fraud operations and extract personal and financial information belonging to thousands of students at Fengxian Campus.

Thousands of Exposed ARTEX Instances Identified

Research from Censys identified 1,465 hosts running exposed ARTEX consoles as of November 4, 2026. Most were located in the United States, Hong Kong, China, Japan, Singapore, and South Korea.

However, researchers cautioned that not every exposed instance should be considered malicious.

Separately, Check Point Research identified 2,557 systems hosting ARTEX, including 10 misconfigured instances that exposed their complete databases.

Check Point observed that ARTEX operators often needed to provide only a target or objective before allowing autonomous agents to continue working. Human involvement was frequently limited to monitoring progress, checking whether a target had been compromised, or adjusting priorities.

Reported malicious activities included:

  • Cryptocurrency theft.
  • Theft of Apple code-signing certificates.
  • Gaming account compromises.
  • Denial-of-service attacks against gambling websites.
  • Exploitation of weak or hard-coded passwords.
  • Abuse of missing authentication and insecure direct object references.
  • Remote code execution.

In one campaign targeting Apple code-signing certificates, ARTEX agents searched compromised systems for certificate databases and attempted to validate stolen certificates by checking passwords, private keys, revocation status, expiration dates, and provisioning profiles.

The activity reportedly resulted in the collection of more than 300 certificates and their associated passwords. Three certificates passed the complete validation process and could potentially be used to sign arbitrary iOS applications.

Around 45 Open-Source Agentic Attack Frameworks Identified

AntiFox and ARTEX are part of a broader ecosystem of approximately 45 open-source agentic attack frameworks designed to connect AI models with tools that can execute actions autonomously.

These frameworks can be grouped into five broad categories:

1. Network Kill Chain Frameworks

Designed to automate reconnaissance, exploitation, and post-exploitation activities.

Examples: PentAGI, RedAmon, and DarkMoon.

2. Web Application and API Testing Frameworks

Focused on identifying and exploiting weaknesses in web applications and APIs.

Examples: Strix, Shannon, and PentestGPT.

3. Command-and-Control Integrated Frameworks

Designed with command-and-control capabilities.

Examples: Sage, echidna, Pojun, and FORANG.

4. Agentic Harnesses

Frameworks that connect AI models with tools and execution workflows.

Examples: RAPTOR, CyberStrike, cyber-harness, Nebula, and Cybermes.

5. Research Prototypes

Experimental projects exploring autonomous security testing and AI-driven exploitation.

Examples: Incalmo, hackingBuddyGPT, VulnBot, HackSynth, AutoPT, and Ares.

What This Means for Cybersecurity Teams

The increasing availability of agentic penetration testing frameworks introduces new challenges for defenders.

AI agents can automate repetitive security operations, investigate multiple targets simultaneously, and continue executing complex attack chains without the fatigue associated with manual operations.

CERT-EU has warned that frameworks such as ARTEX can systematically test large numbers of low-complexity misconfigurations and pursue exploitation paths that human testers might not have enough time to investigate.

For organizations, the AntiFox incidents reinforce the importance of securing internet-facing applications and cloud identities.

Security teams should prioritize:

  • Regular security assessments of internet-facing web applications.
  • Monitoring IIS worker processes for unexpected web shell creation and command execution.
  • Restricting application access to sensitive configuration files and database credentials.
  • Enforcing least-privilege permissions across AWS IAM identities.
  • Monitoring unusual API activity across AWS services.
  • Reviewing successful GetSecretValue requests and unexpected S3 object operations.
  • Rotating exposed credentials and secrets immediately.
  • Enabling comprehensive CloudTrail logging and investigating suspicious identity activity.
  • Identifying exposed AI-powered security testing consoles and restricting unauthorized access.

The biggest concern is not simply that AI can identify vulnerabilities faster. It is that autonomous agents can connect reconnaissance, exploitation, credential discovery, and cloud access into a continuous attack chain.

As these tools become more accessible, defenders will need stronger application security, cloud identity controls, and detection capabilities to keep pace with increasingly automated threats.